Solved: Routing failed to locate next hop for ICMP from outside:10.60.30.111/1 to inside:10.89.30.41/0

d.kuzmano · ‎10-31-2012

ASA 5505 Split tunneling stopped working when upgraded from 8.3(1) to 8.4(3).

When a user was connecting to the old 8.3(1) appliance they could access all of our subnets: 10.60.0.0/16, 10.89.0.0/16, 10.33.0.0/16, 10.1.0.0/16

but now they cannot and in the logs I can just see

6 Oct 31 2012 08:17:59 110003 10.60.30.111 1 10.89.30.41 0 Routing failed to locate next hop for ICMP from outside:10.60.30.111/1 to inside:10.89.30.41/0

any hints? i have tried almost everything. the running configuration is:

: Saved

:

ASA Version 8.4(3)

!

hostname asa

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

ip address 10.60.70.1 255.255.0.0

!

interface Vlan2

nameif outside

security-level 0

ip address 80.90.98.217 255.255.255.248

!

ftp mode passive

clock timezone GMT 0

dns domain-lookup inside

dns domain-lookup outside

same-security-traffic permit intra-interface

object network obj_any

subnet 0.0.0.0 0.0.0.0

object network NETWORK_OBJ_10.33.0.0_16

subnet 10.33.0.0 255.255.0.0

object network NETWORK_OBJ_10.60.0.0_16

subnet 10.60.0.0 255.255.0.0

object network NETWORK_OBJ_10.89.0.0_16

subnet 10.89.0.0 255.255.0.0

object network NETWORK_OBJ_10.1.0.0_16

subnet 10.1.0.0 255.255.0.0

object network tetPC

host 10.60.10.1

description test

object network NETWORK_OBJ_10.60.30.0_24

subnet 10.60.30.0 255.255.255.0

object network NETWORK_OBJ_10.60.30.64_26

subnet 10.60.30.64 255.255.255.192

object network SSH-server

host 10.60.20.6

object network SSH_public

object network ftp_public

host 80.90.98.218

object network rdp

host 10.60.10.4

object network ftp_server

host 10.60.20.2

object network ssh_public

host 80.90.98.218

object service FTP

service tcp destination eq 12

object network NETWORK_OBJ_10.60.20.3

host 10.60.20.3

object network NETWORK_OBJ_10.60.40.192_26

subnet 10.60.40.192 255.255.255.192

object network NETWORK_OBJ_10.60.10.10

host 10.60.10.10

object network NETWORK_OBJ_10.60.20.2

host 10.60.20.2

object network NETWORK_OBJ_10.60.20.21

host 10.60.20.21

object network NETWORK_OBJ_10.60.20.4

host 10.60.20.4

object network NETWORK_OBJ_10.60.20.5

host 10.60.20.5

object network NETWORK_OBJ_10.60.20.6

host 10.60.20.6

object network NETWORK_OBJ_10.60.20.7

host 10.60.20.7

object network NETWORK_OBJ_10.60.20.29

host 10.60.20.29

object service port_tomcat

service tcp source range 8080 8082

object network TBSF

subnet 172.16.252.0 255.255.255.0

object network MailServer

host 10.33.10.2

description Mail Server

object service HTTPS

service tcp source eq https

object network test

object network access_web_mail

host 10.60.50.251

object network downtown_Interface_host

host 10.60.50.1

description downtown Interface Host

object service Oracle_port

service tcp source eq sqlnet

object network NETWORK_OBJ_10.60.50.248_29

subnet 10.60.50.248 255.255.255.248

object network NETWORK_OBJ_10.60.50.1

host 10.60.50.1

object network NETWORK_OBJ_10.60.50.0_28

subnet 10.60.50.0 255.255.255.240

object network brisel

subnet 10.191.191.0 255.255.255.0

object network NETWORK_OBJ_10.191.191.0_24

subnet 10.191.191.0 255.255.255.0

object network NETWORK_OBJ_10.60.60.0_24

subnet 10.60.60.0 255.255.255.0

object-group service TCS_Service_Group

description This Group of available Services is for TCS Clients

service-object object port_tomcat

object-group service HTTPS_ACCESS tcp

port-object eq https

object-group network DM_INLINE_NETWORK_1

network-object 10.1.0.0 255.255.0.0

network-object 10.33.0.0 255.255.0.0

network-object 10.60.0.0 255.255.0.0

network-object 10.89.0.0 255.255.0.0

access-list outside_1_cryptomap extended permit ip 10.60.0.0 255.255.0.0 10.33.0.0 255.255.0.0

access-list outside_2_cryptomap extended permit ip 10.60.0.0 255.255.0.0 10.89.0.0 255.255.0.0

access-list outside_3_cryptomap extended permit ip 10.60.0.0 255.255.0.0 10.1.0.0 255.255.0.0

access-list OUTSIDE_IN extended permit icmp any any time-exceeded

access-list OUTSIDE_IN extended permit icmp any any unreachable

access-list OUTSIDE_IN extended permit icmp any any echo-reply

access-list OUTSIDE_IN extended permit icmp any any source-quench

access-list OUTSIDE_IN extended permit tcp 194.2.20.0 255.255.255.0 host 80.90.98.220 eq smtp

access-list OUTSIDE_IN extended permit tcp host 194.25.12.0 host 80.90.98.220 eq smtp

access-list OUTSIDE_IN extended permit icmp host 80.90.98.222 host 80.90.98.217

access-list OUTSIDE_IN extended permit tcp host 162.162.4.1 host 80.90.98.220 eq smtp

access-list OUTSIDE_IN extended permit tcp host 98.85.125.2 host 80.90.98.221 eq ssh

access-list OAKDCAcl standard permit 10.60.0.0 255.255.0.0

access-list OAKDCAcl standard permit 10.33.0.0 255.255.0.0

access-list OAKDCAcl remark backoffice

access-list OAKDCAcl standard permit 10.89.0.0 255.255.0.0

access-list OAKDCAcl remark maint

access-list OAKDCAcl standard permit 10.1.0.0 255.255.0.0

access-list osgd standard permit host 10.60.20.4

access-list osgd standard permit host 10.60.20.5

access-list osgd standard permit host 10.60.20.7

access-list testOAK_splitTunnelAcl standard permit 10.60.0.0 255.255.0.0

access-list snmp extended permit udp any eq snmptrap any

access-list snmp extended permit udp any any eq snmp

access-list downtown_splitTunnelAcl standard permit host 10.60.20.29

access-list webMailACL standard permit host 10.33.10.2

access-list HBSC standard permit host 10.60.30.107

access-list HBSC standard deny 10.33.0.0 255.255.0.0

access-list HBSC standard deny 10.89.0.0 255.255.0.0

access-list outside_4_cryptomap extended permit ip 10.60.0.0 255.255.0.0 10.191.191.0 255.255.255.0

access-list OAK-remote_splitTunnelAcl standard permit 10.1.0.0 255.255.0.0

access-list OAK-remote_splitTunnelAcl standard permit 10.33.0.0 255.255.0.0

access-list OAK-remote_splitTunnelAcl standard permit 10.60.0.0 255.255.0.0

access-list OAK-remote_splitTunnelAcl standard permit 10.89.0.0 255.255.0.0

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool OAKPRD_pool 10.60.30.110-10.60.30.150 mask 255.255.0.0

ip local pool mail_sddress_pool 10.60.50.251-10.60.50.255 mask 255.255.0.0

ip local pool test 10.60.50.1 mask 255.255.255.255

ip local pool ipad 10.60.30.90-10.60.30.99 mask 255.255.0.0

ip local pool TCS_pool 10.60.40.200-10.60.40.250 mask 255.255.255.0

ip local pool OSGD_POOL 10.60.50.2-10.60.50.10 mask 255.255.0.0

ip local pool OAK_pool 10.60.60.0-10.60.60.255 mask 255.255.0.0

ip verify reverse-path interface inside

ip verify reverse-path interface outside

ip audit name ThreatDetection attack action alarm

ip audit interface inside ThreatDetection

ip audit interface outside ThreatDetection

no failover

icmp unreachable rate-limit 1 burst-size 1

icmp permit any inside

icmp permit any echo inside

icmp permit any echo outside

asdm history enable

arp timeout 14400

nat (inside,outside) source static NETWORK_OBJ_10.60.0.0_16 NETWORK_OBJ_10.60.0.0_16 destination static NETWORK_OBJ_10.33.0.0_16 NETWORK_OBJ_10.33.0.0_16

nat (inside,outside) source static NETWORK_OBJ_10.60.0.0_16 NETWORK_OBJ_10.60.0.0_16 destination static NETWORK_OBJ_10.89.0.0_16 NETWORK_OBJ_10.89.0.0_16

nat (inside,outside) source static NETWORK_OBJ_10.60.0.0_16 NETWORK_OBJ_10.60.0.0_16 destination static NETWORK_OBJ_10.1.0.0_16 NETWORK_OBJ_10.1.0.0_16

nat (inside,outside) source static any any destination static NETWORK_OBJ_10.60.30.0_24 NETWORK_OBJ_10.60.30.0_24

nat (inside,outside) source static any any destination static NETWORK_OBJ_10.60.30.64_26 NETWORK_OBJ_10.60.30.64_26

nat (inside,outside) source static NETWORK_OBJ_10.60.20.29 NETWORK_OBJ_10.60.20.29 destination static NETWORK_OBJ_10.60.40.192_26 NETWORK_OBJ_10.60.40.192_26 service any port_tomcat

nat (inside,outside) source static any any destination static NETWORK_OBJ_10.60.50.1 NETWORK_OBJ_10.60.50.1

nat (inside,outside) source static MailServer MailServer destination static NETWORK_OBJ_10.60.50.248_29 NETWORK_OBJ_10.60.50.248_29

nat (inside,outside) source static any any destination static NETWORK_OBJ_10.60.50.0_28 NETWORK_OBJ_10.60.50.0_28

nat (inside,outside) source static NETWORK_OBJ_10.60.0.0_16 NETWORK_OBJ_10.60.0.0_16 destination static NETWORK_OBJ_10.191.191.0_24 NETWORK_OBJ_10.191.191.0_24

nat (inside,outside) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static NETWORK_OBJ_10.60.60.0_24 NETWORK_OBJ_10.60.60.0_24 no-proxy-arp route-lookup

!

object network obj_any

nat (inside,outside) dynamic interface

route outside 0.0.0.0 0.0.0.0 80.90.98.222 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

http 10.60.10.10 255.255.255.255 inside

http 10.33.30.33 255.255.255.255 inside

http 10.60.30.33 255.255.255.255 inside

snmp-server host inside 10.33.30.108 community ***** version 2c

snmp-server host inside 10.89.70.30 community *****

no snmp-server location

no snmp-server contact

snmp-server community *****

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA mode transport

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set lux_trans_set esp-aes esp-sha-hmac

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 1 match address outside_1_cryptomap

crypto map outside_map 1 set peer 84.51.31.173

crypto map outside_map 1 set ikev1 transform-set ESP-3DES-SHA

crypto map outside_map 2 match address outside_2_cryptomap

crypto map outside_map 2 set peer 98.85.125.2

crypto map outside_map 2 set ikev1 transform-set ESP-3DES-SHA

crypto map outside_map 3 match address outside_3_cryptomap

crypto map outside_map 3 set peer 220.79.236.146

crypto map outside_map 3 set ikev1 transform-set ESP-3DES-SHA

crypto map outside_map 4 match address outside_4_cryptomap

crypto map outside_map 4 set pfs

crypto map outside_map 4 set peer 159.146.232.122

crypto map outside_map 4 set ikev1 transform-set lux_trans_set

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto ikev1 enable outside

crypto ikev1 policy 5

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 20

authentication pre-share

encryption aes-256

hash sha

group 5

lifetime 86400

crypto ikev1 policy 30

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 28800

crypto ikev1 policy 50

authentication pre-share

encryption aes

hash sha

group 1

lifetime 86400

crypto ikev1 policy 70

authentication pre-share

encryption aes

hash sha

group 5

lifetime 86400

telnet 10.60.10.10 255.255.255.255 inside

telnet 10.60.10.1 255.255.255.255 inside

telnet 10.60.10.5 255.255.255.255 inside

telnet 10.60.30.33 255.255.255.255 inside

telnet 10.33.30.33 255.255.255.255 inside

telnet timeout 30

ssh 10.60.10.5 255.255.255.255 inside

ssh 10.60.10.10 255.255.255.255 inside

ssh 10.60.10.3 255.255.255.255 inside

ssh timeout 5

console timeout 0

dhcpd auto_config outside

!

dhcpd dns 155.2.10.20 155.2.10.50 interface inside

dhcpd auto_config outside interface inside

!

threat-detection basic-threat

threat-detection scanning-threat shun duration 3600

threat-detection statistics

threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200

tftp-server inside 10.60.10.10 configs/config1

webvpn

group-policy testTG internal

group-policy testTG attributes

dns-server value 155.2.10.20 155.2.10.50

vpn-tunnel-protocol ikev1

group-policy DefaultRAGroup_1 internal

group-policy DefaultRAGroup_1 attributes

dns-server value 155.2.10.20 155.2.10.50

vpn-tunnel-protocol l2tp-ipsec

group-policy TcsTG internal

group-policy TcsTG attributes

vpn-idle-timeout 20

vpn-session-timeout 120

vpn-tunnel-protocol ikev1

ipsec-udp disable

ipsec-udp-port 10000

split-tunnel-policy tunnelspecified

split-tunnel-network-list value testOAK_splitTunnelAcl

address-pools value TCS_pool

group-policy downtown_interfaceTG internal

group-policy downtown_interfaceTG attributes

dns-server value 155.2.10.20 155.2.10.50

vpn-tunnel-protocol ikev1

split-tunnel-policy tunnelspecified

split-tunnel-network-list value downtown_splitTunnelAcl

group-policy HBSCTG internal

group-policy HBSCTG attributes

dns-server value 155.2.10.20 155.2.10.50

vpn-tunnel-protocol ikev1

split-tunnel-policy tunnelspecified

split-tunnel-network-list value HBSC

group-policy OSGD internal

group-policy OSGD attributes

dns-server value 155.2.10.20 155.2.10.50

vpn-session-timeout none

vpn-tunnel-protocol ikev1

group-lock value OSGD

split-tunnel-policy tunnelspecified

split-tunnel-network-list value testOAK_splitTunnelAcl

group-policy OAKDC internal

group-policy OAKDC attributes

vpn-tunnel-protocol ikev1

group-lock value OAKDC

split-tunnel-policy tunnelspecified

split-tunnel-network-list value OAKDCAcl

intercept-dhcp 255.255.0.0 disable

address-pools value OAKPRD_pool

group-policy mailTG internal

group-policy mailTG attributes

dns-server value 155.2.10.20 155.2.10.50

vpn-tunnel-protocol ikev1

split-tunnel-policy tunnelspecified

split-tunnel-network-list value webMailACL

group-policy OAK-remote internal

group-policy OAK-remote attributes

dns-server value 155.2.10.20 155.2.10.50

vpn-tunnel-protocol ikev1

split-tunnel-policy tunnelspecified

split-tunnel-network-list value OAK-remote_splitTunnelAcl

vpn-group-policy OAKDC

service-type nas-prompt

tunnel-group DefaultRAGroup general-attributes

address-pool OAKPRD_pool

address-pool ipad

default-group-policy DefaultRAGroup_1

tunnel-group DefaultRAGroup ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group 84.51.31.173 type ipsec-l2l

tunnel-group 84.51.31.173 ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group 98.85.125.2 type ipsec-l2l

tunnel-group 98.85.125.2 ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group 220.79.236.146 type ipsec-l2l

tunnel-group 220.79.236.146 ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group OAKDC type remote-access

tunnel-group OAKDC general-attributes

address-pool OAKPRD_pool

default-group-policy OAKDC

tunnel-group OAKDC ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group TcsTG type remote-access

tunnel-group TcsTG general-attributes

address-pool TCS_pool

default-group-policy TcsTG

tunnel-group TcsTG ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group downtown_interfaceTG type remote-access

tunnel-group downtown_interfaceTG general-attributes

address-pool test

default-group-policy downtown_interfaceTG

tunnel-group downtown_interfaceTG ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group TunnelGroup1 type remote-access

tunnel-group mailTG type remote-access

tunnel-group mailTG general-attributes

address-pool mail_sddress_pool

default-group-policy mailTG

tunnel-group mailTG ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group testTG type remote-access

tunnel-group testTG general-attributes

address-pool mail_sddress_pool

default-group-policy testTG

tunnel-group testTG ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group OSGD type remote-access

tunnel-group OSGD general-attributes

address-pool OSGD_POOL

default-group-policy OSGD

tunnel-group OSGD ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group HBSCTG type remote-access

tunnel-group HBSCTG general-attributes

address-pool OSGD_POOL

default-group-policy HBSCTG

tunnel-group HBSCTG ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group 159.146.232.122 type ipsec-l2l

tunnel-group 159.146.232.122 ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group OAK-remote type remote-access

tunnel-group OAK-remote general-attributes

address-pool OAK_pool

default-group-policy OAK-remote

tunnel-group OAK-remote ipsec-attributes

ikev1 pre-shared-key *****

!

policy-map global_policy

!

prompt hostname context

no call-home reporting anonymous

hpm topN enable

: end

asdm history enable

Javier Portuguez · ‎10-31-2012

Hi Darko,

I can see that you have:

access-list outside_2_cryptomap extended permit ip 10.60.0.0 255.255.0.0 10.89.0.0 255.255.0.0

So, please make the following changes:

network object obj-10.60.30.0

subnet 10.60.30.0 255.255.255.0

!

route outside 10.60.30.0 255.255.255.0 80.90.98.222

route outside 10.89.0.0 255.255.0.0 80.90.98.222

nat (outside,outside) 1 source static obj-10.60.30.0 obj-10.60.30.0 destination static NETWORK_OBJ_10.89.0.0_16 NETWORK_OBJ_10.89.0.0_16 no-proxy-arp route-lookup

HTH

Portu.

Please rate any helpful posts

Message was edited by: Javier Portuguez

View solution in original post

Javier Portuguez · ‎10-31-2012

Hi Darko,

I can see that you have:

access-list outside_2_cryptomap extended permit ip 10.60.0.0 255.255.0.0 10.89.0.0 255.255.0.0

So, please make the following changes:

network object obj-10.60.30.0

subnet 10.60.30.0 255.255.255.0

!

route outside 10.60.30.0 255.255.255.0 80.90.98.222

route outside 10.89.0.0 255.255.0.0 80.90.98.222

nat (outside,outside) 1 source static obj-10.60.30.0 obj-10.60.30.0 destination static NETWORK_OBJ_10.89.0.0_16 NETWORK_OBJ_10.89.0.0_16 no-proxy-arp route-lookup

HTH

Portu.

Please rate any helpful posts

Message was edited by: Javier Portuguez

d.kuzmano · ‎11-02-2012

Yes, that worked, thanks a lot.

I have read some other similar posts, but the puzzaling part is i didnt have to do this way on 8.3(1)

Also like this i'm using one of our public IPs (80.90.98.222).

will it work if i just put the public IP of the ASA 80.90.98.217 (i didnt test because it is a PRD env)?

Thanks,

Darko

Javier Portuguez · ‎11-02-2012

Dear Darko,

The problem here is the overlapp issue with the Internal network.

Since the VPN pool is:

ip local pool OAKPRD_pool 10.60.30.110-10.60.30.150 mask 255.255.0.0

And the local network is:

interface Vlan1

nameif inside

security-level 100

ip address 10.60.70.1 255.255.0.0

So since you have some NAT rules telling the FW that 10.60.0.0/16 is connected to the inside, we need to change that and force it to know that 10.60.30.0/24 is actually reachable to the outside.

On the other hand, yes you could point to outside interface, but is not a good practice.

Thanks.

Portu.

In case you do not have any further questions, please mark this post as answered.